CVE-2019-7939: XSS
First published: Tue Jun 25 2019(Updated: )
A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's browser.
Credit: psirt@adobe.com psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/magento/product-community-edition | >=2.1<2.1.18>=2.2<2.2.9>=2.3<2.3.2 | |
| composer/magento/community-edition | >=2.3<2.3.2 | 2.3.2 |
| composer/magento/community-edition | >=2.2<2.2.9 | 2.2.9 |
| composer/magento/community-edition | >=2.1<2.1.18 | 2.1.18 |
| CentOS Libgcc | >=2.1.0<2.1.18 | |
| CentOS Libgcc | >=2.2.0<2.2.9 | |
| CentOS Libgcc | >=2.3.0<2.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
- https://nvd.nist.gov/vuln/detail/CVE-2019-7939
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7939.yaml
- https://github.com/advisories/GHSA-r728-jwf5-f5r5 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2019-7939?
CVE-2019-7939 is considered a high-severity vulnerability due to its potential for reflected cross-site scripting attacks.
How do I fix CVE-2019-7939?
To fix CVE-2019-7939, update Magento to versions 2.1.18, 2.2.9, or 2.3.2 or later.
Which versions of Magento are affected by CVE-2019-7939?
CVE-2019-7939 affects Magento 2.1 versions prior to 2.1.18, 2.2 versions prior to 2.2.9, and 2.3 versions prior to 2.3.2.
How can CVE-2019-7939 be exploited?
CVE-2019-7939 can be exploited by sending a victim a crafted URL that executes malicious JavaScript in their browser.
What type of vulnerability is CVE-2019-7939?
CVE-2019-7939 is classified as a reflected cross-site scripting (XSS) vulnerability.
- collector/friends-of-php
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r728-jwf5-f5r5
- alias/CVE-2019-7939
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/composer
- vendor/magento
- canonical/centos libgcc
- version/centos libgcc/2.1.0
- version/centos libgcc/2.2.0
- version/centos libgcc/2.3.0